As a first security hire, treat Cyber Essentials as a four week project: gather the question set, run the readiness tool, fix the gaps it finds, then submit through the self-led or supported route. It is one of the few frameworks where the exam paper is public, so you can rehearse before paying.
What resources are free?
The NCSC offers three free aids on its overview page. You can download the assessment questions and preview the question set, with a separate Requirements for IT Infrastructure document to help answer them. There is a free Readiness Tool that produces a tailored action plan. And small and medium sized enterprises can book 30 minutes of free consultation with an NCSC-assured Cyber Advisor.
Use all three before you register. The question set tells you exactly what will be asked, and nothing in the exam is secret.
What does the exam check?
Five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The questions ask about your organisation's devices, networks, cloud services and accounts, so the real work is knowing what you have.
How should you run the project?
Week 1: list the estate. Every laptop, phone, server, network device and cloud service that holds company data, with owner and operating system. You will find unknowns. Shadow SaaS tools are the usual surprise.
Week 2: answer honestly in draft. Fill the question set in a document, noting where the answer is "no" or "not sure." Do not polish yet.
Week 3: fix. The common fixes are enabling multi-factor sign-in on cloud accounts, turning on automatic updates, removing admin rights from daily accounts, deleting default or shared accounts, and retiring unsupported software.
Week 4: submit. Register and complete the assessment.
Which route do you pick?
The NCSC lists two. Self-led: register through IASME, pay, complete the verified self-assessment, have a board member or equivalent sign off the answers, and an assessor marks them. Supported: a Certification Body licensed by IASME helps you understand the questions and how they apply. If this is your first time and your estate is messy, supported is worth considering. If you have a tidy estate and time, self-led is fine.
Who signs?
A board member or equivalent. Brief them before submission and show them the draft answers, since they are attesting to them. Do not let this surprise a director on the day.
What should you not claim?
Do not say you are certified until the certificate is issued. Do not claim Cyber Essentials Plus unless you have passed the independent technical testing. Check certified status of others through the delivery partner's certificate search, and expect customers to check yours the same way.
What comes after?
Diarise renewal. Keep the estate list live, because the next assessment starts from it. If a buyer then asks for something broader, you have a documented baseline to build on.
How to check or apply this
- Download the question set and the Requirements document.
- Run the Readiness Tool and save the action plan.
- Book the free Cyber Advisor session if you are an eligible small business.
- Build the device and cloud account list.
- Fix gaps, then brief the board signatory.
- Pick a route and submit.
Quick check
Can I see the questions before I register?
Yes. The NCSC offers the question set as a free download to preview.
Do I need Plus?
Only if a buyer asks for it or you want independent technical testing. It covers the same five controls.
Sources
Last reviewed: 18 October 2026.
